diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf
index e6b3c641..566883b2 100644
--- a/config/filter.d/common.conf
+++ b/config/filter.d/common.conf
@@ -82,8 +82,7 @@ datepattern = %(lt_short/datepattern)s
 
 [lt_rfc5424]
 # RFC 5424 log-format, see gh-2309:
-#__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ \S+\s+
-__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ (?:[^\[\]\s]+|(?:\[(?:[^\]"]*|"[^"]*")*\])+)\s+
+__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ (?:-|(?:\[(?:[^\]"]|"(?:[^"\\]|\\.)*")*\])+)\s+
 datepattern = ^<\d+>\d+\s+{DATE}
 
 # Author: Yaroslav Halchenko, Sergey G. Brester (aka sebres)
diff --git a/fail2ban/tests/files/logs/sshd b/fail2ban/tests/files/logs/sshd
index 1a50d49f..961cd79e 100644
--- a/fail2ban/tests/files/logs/sshd
+++ b/fail2ban/tests/files/logs/sshd
@@ -414,4 +414,11 @@ Nov 26 16:47:51 srv sshd[19320]: Disconnected from authenticating user root 192.
 # failJSON: { "time": "2019-07-08T23:40:17", "match": true , "host": "192.0.2.2", "desc": "RFC 5424 format with extra data and brackets in value (gh-2309)" }
 <38>1 2019-07-08T17:40:17.954167-04:00 hostname.example.com sshd 55555 - [timeQuality tzKnown="1" isSynced="0"][xxx@123 test="[brackets]"] Failed unknown for invalid user redmond from 192.0.2.2 port 55555 ssh2
 
+# failJSON: { "match": false , "desc": "RFC 5424 format, injection attempt on STRUCTURED-DATA field (GHSA-c2mg-2r7g-c3wp)" }
+<38>1 2019-07-08T17:40:17.954169-04:00 hostname.example.com sshd 12345 123 [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+# failJSON: { "match": false , "desc": "RFC 5424 format, injection attempt on STRUCTURED-DATA 2nd field (GHSA-c2mg-2r7g-c3wp)" }
+<38>1 2019-07-08T17:40:17.954170-04:00 hostname.example.com sshd 12345 123 [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA][BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
+# failJSON: { "match": false , "desc": "RFC 5424 format, injection attempt on STRUCTURED-DATA, unescaped new-line in PARAM-VALUE (GHSA-c2mg-2r7g-c3wp)" }
+<38>1 2019-07-08T17:40:17.954171-04:00 hostname.example.com sshd 12345 123 [AAAAAAAAAAAAAAAAAAAAAAAAAA XXX="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+
 # addFILE: "sshd-journal"